CVE-2025-48928

TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability

공격에 악용됨 보통 4.0 공격 가능성: 0.6%

무엇인가

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.

CISA: TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.

할 일

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

미국 연방 기관 조치 기한: 2025년 7월 22일

CISA 목록에 추가됨: 2025년 7월 1일
게시됨: 2025년 5월 28일
심각도: 보통 4.0 CVSS 3.1
향후 30일 내 공격 가능성(EPSS): 0.6% 알려진 모든 취약점 중 상위 52.7%
약점 유형: CWE-528
자세히: NVD · CVE.org · CISA

모든 참고 자료(1)

https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/

TeleMessage의 다른 악용된 결함

추가됨	취약점	제품	심각도	공격 가능성
2025. 7. 1.	Initialization of a Resource with an Insecure DefaultCVE-2025-48927	TM SGNL	보통 5.3	12%
2025. 5. 12.	Hidden FunctionalityCVE-2025-47729	TM SGNL	낮음 1.9	0.4%

모두 →

출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.